Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →If a subdomain displays the main domain’s website, DNS is usually only half of the setup. The subdomain may correctly resolve to the server’s IP address, but Nginx or Apache is not matching the requested hostname to the subdomain’s virtual host. The unmatched request then falls through to the default server or first-listed virtual host, which often contains the main site.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Fix it by verifying the DNS record, creating an exact hostname match for the subdomain, configuring both HTTP and HTTPS where applicable, checking for application-level redirects, and testing with an explicit Host and TLS SNI request before reloading the web server.
As an Amazon Associate I earn from qualifying purchases.
Why the subdomain shows the main website
A single server can host many domains and subdomains on one IP address. DNS only directs a name to an address; it does not select a website directory or proxy target. After the connection reaches the server, the web server must decide which virtual host should handle the request.
HTTP uses the Host header
For an HTTP request, the browser sends a Host value such as sub.example.com. Nginx compares that value with each server_name. Apache compares it with ServerName and deliberate ServerAlias values. If no virtual host matches, Nginx routes the request to the default server for that port, while Apache commonly uses the first-listed virtual host for the address and port.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
HTTPS adds TLS SNI before HTTP routing
HTTPS has an additional selection step. During the TLS handshake, the client sends the requested hostname as Server Name Indication (SNI). Nginx or Apache can use SNI to select a certificate and TLS virtual host before the encrypted HTTP request, including its Host header, is processed. A correct port-80 configuration therefore does not guarantee that port 443 will serve the same subdomain.
This creates three common outcomes:
- The subdomain’s DNS record is wrong, so the request reaches another server.
- DNS is correct, but the server has no exact subdomain virtual host, so the main site’s default or first vhost answers.
- The correct site is served initially, but the application or reverse proxy returns a redirect to the main domain.
Step 1: Verify DNS before editing Nginx or Apache
Check every record that can affect the client’s route. An A record points the subdomain to an IPv4 address; an AAAA record points it to IPv6; a CNAME makes the subdomain an alias of another hostname. The resulting address must be the server that contains the intended subdomain configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check A, AAAA, and CNAME answers
dig +short sub.example.com A
dig +short sub.example.com AAAA
dig +short sub.example.com CNAMEOn systems without dig, use the equivalent DNS lookup utility available on the host. Compare the returned IPv4 and IPv6 addresses with the server’s actual addresses. If an AAAA record points somewhere different from the A record, IPv6-capable visitors may consistently see a different site even while IPv4 testing looks correct.
Check the DNS provider’s target
- For an A or AAAA record, confirm the address is the intended web server.
- For a CNAME, follow the alias and confirm its final A and AAAA answers.
- Remove stale records that direct the subdomain to an old server, unless that split routing is intentional.
- Allow for DNS caching after a change; test from a resolver that returns the current record before diagnosing virtual-host matching.
Once DNS reaches the right machine, continue with the web-server configuration. Do not add a second DNS record as a substitute for a missing virtual host.
Step 2: Fix Nginx hostname matching
Nginx chooses a server block from the listening address and port, then matches the hostname against server_name. Exact names, wildcard names, and regular-expression names have different matching rules. For a single subdomain, an exact name is the clearest and least surprising choice.
Create a dedicated HTTP server block
server {
listen 80;
server_name sub.example.com;
root /var/www/sub.example.com;
index index.html;
}Replace the root path with the directory that actually contains the subdomain’s files. If the subdomain is an application behind a process manager or another web server, use the intended proxy target instead of a static root:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
server {
listen 80;
server_name sub.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}The proxy example is a pattern, not a universal port or application configuration. Use the address and headers required by the application. In particular, preserve the original host when the application uses it to build canonical URLs.
Remove accidental matches from the main site
Open the server block that serves the main domain. Its server_name list should contain only names that are supposed to serve that site. Remove sub.example.com if it was added there accidentally. Also inspect wildcard entries such as *.example.com; a wildcard may intentionally or unintentionally catch the subdomain.
Check whether another block is marked default_server on port 80. A default server is useful for deliberate catch-all behavior, but it will answer unmatched names. The presence of a default block is not itself an error; the problem is an absent, misspelled, or otherwise nonmatching subdomain block.
Configure HTTPS separately
Create a 443 server block whose server_name is the same exact subdomain. It must have a certificate and private key whose certificate name or Subject Alternative Name covers sub.example.com.
server {
listen 443 ssl;
server_name sub.example.com;
ssl_certificate /etc/ssl/sub.example.com/fullchain.pem;
ssl_certificate_key /etc/ssl/sub.example.com/privkey.pem;
root /var/www/sub.example.com;
index index.html;
}Use the certificate paths and TLS settings supplied by your certificate-management system when it manages Nginx. If HTTP should redirect to HTTPS, keep that redirect in the subdomain’s port-80 block rather than relying on the main domain’s redirect:
server {
listen 80;
server_name sub.example.com;
return 301 https://sub.example.com$request_uri;
}Do not assume that a certificate for example.com covers every subdomain. A certificate must explicitly include the requested hostname or a matching wildcard, and the 443 block must still route the request to the intended files or proxy.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Validate and reload Nginx
- Run
nginx -tusing the same installation and configuration path as the running service. - Fix every syntax or certificate-path error reported by the test; do not reload a configuration that has failed validation.
- Reload Nginx through the service manager or hosting platform’s approved control panel.
- Retest both HTTP and HTTPS with the commands in the verification section below.
Step 3: Fix Apache virtual-host matching
Apache selects a virtual host by listening address and port, then by the hostname in ServerName or ServerAlias. Apache’s documented fallback is the first listed virtual host for an address and port when no name matches, which explains why the main site often appears for a new subdomain.
Create an HTTP virtual host
<VirtualHost *:80>
ServerName sub.example.com
DocumentRoot /var/www/sub.example.com
ErrorLog ${APACHE_LOG_DIR}/sub-error.log
CustomLog ${APACHE_LOG_DIR}/sub-access.log combined
</VirtualHost>Use a separate ServerName for each distinct site. Add ServerAlias only for names that should intentionally serve the same content, such as a deliberately configured alternate hostname. Do not place the main domain or an unrelated wildcard alias in the subdomain vhost.
Free tools Windows power users keep installed
One-click scans. No signup required.
If the subdomain is proxied to an application, use the appropriate proxy modules and directives instead of DocumentRoot. Keep the proxy target, forwarded headers, and application’s public URL consistent with the subdomain.
Add a matching HTTPS virtual host
<VirtualHost *:443>
ServerName sub.example.com
DocumentRoot /var/www/sub.example.com
SSLEngine on
SSLCertificateFile /etc/ssl/sub.example.com/fullchain.pem
SSLCertificateKeyFile /etc/ssl/sub.example.com/privkey.pem
ErrorLog ${APACHE_LOG_DIR}/sub-ssl-error.log
CustomLog ${APACHE_LOG_DIR}/sub-ssl-access.log combined
</VirtualHost>The exact TLS directives and certificate-file layout vary by operating system and certificate manager. The important matching requirements are a 443 virtual host, the same ServerName, and a certificate covering the subdomain. A port-80 vhost alone cannot control encrypted requests.
Enable, inspect, and reload
- On distributions that use site-available and site-enabled directories, enable the new site with the distribution’s site-enabling command.
- Run
apachectl -S(orhttpd.exe -Son Windows) to print the parsed addresses, ports, vhost order, names, and duplicate-name warnings. - Run the platform’s Apache syntax check, commonly
apachectl configtest, and resolve any error before reloading. - Reload Apache through the service manager or hosting platform.
- Repeat the explicit HTTP and HTTPS tests and inspect the logs for the request.
The output of apachectl -S is especially useful when a file exists on disk but Apache did not load it, when two vhosts claim the same name, or when the order differs from what you expected.
Step 4: Treat HTTPS as an independent troubleshooting branch
When HTTP works and HTTPS shows the main site, compare the two configurations rather than changing DNS again. Check all of the following:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- The subdomain has a 443 server block or virtual host, not only a port-80 definition.
- The 443 block uses the exact subdomain in
server_nameorServerName. - The certificate presented during the handshake covers the subdomain.
- The 443 block points to the same intended document root or proxy target as HTTP, unless a different target is deliberate.
- No default TLS server or first-listed 443 vhost is answering because the hostname is misspelled or absent.
SNI lets the server choose a TLS configuration before it sees the encrypted HTTP request. A wrong 443 match can therefore present the main site’s certificate, the main site’s content, or both. Fix the 443 selection and certificate together.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 5: Determine whether the application is redirecting
Sometimes the server selects the correct subdomain content, but the browser changes the address to the main domain. That is not a DNS or virtual-host fallback; it is usually an HTTP redirect generated by the application, reverse proxy, or canonical-URL setting.
Inspect the response headers
curl -I http://sub.example.com/
curl -I https://sub.example.com/Look for a 301 or 302 status and its Location header. If Location names the main domain, inspect the application’s configured public URL, canonical host, HTTPS-awareness, and reverse-proxy headers. A proxy that fails to pass the original host or scheme can make an application believe every request arrived at the main domain or over plain HTTP.
If the response is a 200 status with the wrong page and no redirect, continue investigating virtual-host selection, document roots, proxy targets, and deployment files instead of changing canonical-URL settings.
Step 6: Test the intended IP with explicit Host and SNI values
Testing by hostname alone can hide which address DNS supplied. The --resolve option makes curl connect to a chosen server IP while still sending the requested hostname and SNI.
curl -I --resolve sub.example.com:80:SERVER_IP http://sub.example.com/
curl -I --resolve sub.example.com:443:SERVER_IP https://sub.example.com/Replace SERVER_IP with the intended IPv4 address. For an IPv6 test, use the appropriate IPv6 literal format supported by your curl version. Compare these results:
- HTTP status and any
Locationheader. - The certificate subject and Subject Alternative Names for HTTPS.
- Response headers identifying the proxy or application.
- Whether the body comes from the subdomain’s document root or application.
To isolate a plain HTTP virtual-host issue without DNS, connect to the server IP while sending an explicit Host header:
curl -I -H 'Host: sub.example.com' http://SERVER_IP/These tests distinguish DNS errors from server matching errors and reveal whether HTTPS has a separate failure.
Nginx and Apache: what differs in practice
| Diagnostic area | Nginx | Apache |
|---|---|---|
| Hostname directive | server_name inside a server block |
ServerName and deliberate ServerAlias inside a VirtualHost |
| Unmatched-name behavior | Routes to the default server for the port | Uses the first-listed matching address-and-port virtual host |
| Static content | root and optional index |
DocumentRoot |
| Application content | Usually proxy_pass in a location |
Proxy directives and enabled proxy modules |
| HTTPS setup | Separate listen 443 ssl block, hostname, and certificate |
Separate VirtualHost *:443, ServerName, TLS engine, and certificate directives |
| Configuration inspection | nginx -t validates syntax and references |
apachectl -S shows parsed vhosts; apachectl configtest checks syntax |
The names differ, but the underlying fix is the same: make the requested hostname match one intentional virtual host on each required port, then ensure that host points to the right content.
Troubleshooting by symptom
The subdomain resolves to the wrong IP address
Correct the A, AAAA, or CNAME record at the authoritative DNS provider. Check IPv4 and IPv6 independently. Do not debug Nginx or Apache on a server that the affected resolver never reaches.
HTTP always displays the main site
Inspect the port-80 Nginx server_name or Apache ServerName. Look for spelling differences, an accidental alias in the main site, a wildcard match, a disabled site file, or a default/first-listed vhost receiving the request.
HTTP works but HTTPS displays the main site
Inspect the 443 configuration and the certificate separately from port 80. Confirm SNI hostname matching, certificate coverage, document root or proxy target, and the order of TLS virtual hosts.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The browser jumps to the main domain
Inspect the 301 or 302 Location header. A redirect naming the main domain points to application or proxy canonical-host configuration. Check forwarded host and scheme headers and review the application logs.
The wrong site appears only for some visitors
Compare A and AAAA responses, resolver caches, and the addresses used by different networks. A stale DNS record or an IPv6 path to a differently configured server can create selective failures. After DNS is correct, run the explicit --resolve tests against each address.
The configuration looks correct but changes have no effect
Validate that the edited file is included by the running service, that the site was enabled where required, and that the reload succeeded. Use Nginx’s configuration test or Apache’s parsed-vhost output, then check access and error logs for a new request.
Quick Recap
Final verification checklist
- DNS A, AAAA, and CNAME records resolve to the intended server.
- The subdomain has an exact HTTP hostname match in Nginx or Apache.
- The main-domain configuration does not accidentally claim the subdomain.
- The intended static root or proxy target exists and is readable or reachable.
- A separate HTTPS host configuration uses the same subdomain name.
- The HTTPS certificate covers the subdomain and is actually presented.
- Configuration validation passes before reload.
- Explicit Host and SNI curl requests return the expected status, headers, certificate, and content.
- No application redirect sends the browser to the main domain.
- Logs show the request in the subdomain’s access and error logs, not only in the main site’s logs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
